An issue was discovered in GNU libiberty as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value leading to an integer overflow and resultant heap-based buffer overflow.

🗓️ 18 Aug 2020 07:00:00Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 1 Views

Flaw in GNU libiberty 2.32: simple_object_elf_match misses zero shstrndx, causing overflow.

Reporter	Title	Published	Views	Family All 120
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in GNU Binutils affect IBM Netezza Performance Server	31 May 202203:16	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in GNU binutils affect IBM Netezza Analytics for NPS	31 May 202203:16	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in GNU binutils affect IBM Netezza Analytics	13 Jan 202115:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in GNU Binutils affect IBM Netezza Platform Software clients.	23 Jul 202009:47	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0120: binutils (ALINUX3-SA-2022:0120)	14 May 202500:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : binutils (EulerOS-SA-2020-1094)	24 Feb 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2020-1142)	25 Feb 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : binutils (EulerOS-SA-2020-1363)	2 Apr 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization 3.0.2.2 : binutils (EulerOS-SA-2020-1466)	16 Apr 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.2.0 : binutils (EulerOS-SA-2020-1548)	1 May 202000:00	–	nessus

Vulners

Node

microsoft cm1_binutils_2.32-4Range<2.32-4

18 Aug 2020 07:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 24.3

CVSS 3.15.5

EPSS0.00186

gnu libiberty binutils simple object elf zero shstrndx integer overflow heap overflow